That’s where Cyber.org comes in, said Executive Director Laurie Salvail. The organization, which is funded by the Cybersecurity and Infrastructure Security Agency and other sources, aims to develop the cybersecurity workforce by supporting K-12 cyber education and career awareness efforts.
Project REACH is one of its more recent efforts. The program, now two years old, aims to create a more diverse body of rising cybersecurity professionals. To do so, it helps K-12 schools launch and maintain cybersecurity offerings like classes or afterschool cyber clubs to prepare students in cyber and connects them with cyber and computer science degree programs at minority-serving institutions.
Year one saw the program connect 13 historically Black colleges and universities (HBCUs) with local high schools. Project REACH has since expanded to add three Hispanic-serving institutions (HSIs), and Cyber.org is in discussions with several tribal schools that are prospective participants, Salvail said. This past summer also saw 14 summer camps held for high schoolers, in nine states.
Dylan Wright, a senior at Shreveport, La.’s Woodlawn Leadership Academy, has been participating in Project REACH, including attending a cyber summer camp at Grambling State University and taking cyber classes as part of his regular school day.
Wright was largely unfamiliar with cybersecurity and computer science before joining the program but said hearing about the fields’ earnings potential was an immediate hook. He now has a scholarship to Grambling’s cybersecurity and cloud computing programs.
“They started talking about the different careers, and when the salaries got to six figures, it was interesting,” Wright said.
BRINGING CYBER TO SCHOOLS
The schools that connect with Cyber.org have different needs and resources. Some high schools may be eager to add a cyber class, while others — bound by state curriculum mandates, already packed school day schedules or other obstacles — instead opt for an afterschool club. Universities and high schools may also team up on dual enrollment programs.
In all cases, Cyber.org aims to help instructors learn how to teach the material. That can also include helping higher ed professors learn how to adjust their approach for high schoolers.
Cyber.org offers 17 courses, so schools can select the ones that meet their needs, and it offers free, ongoing professional development on teaching them. In some cases, the new cyber instructors may be switching over from very different topics, like English language arts or history, and getting used to a subject where, thanks to the rapid pace of technology advancement, the material is ever-changing, Salvail said.
Cyber.org has certified teachers on staff who school teachers can call upon for help, even mid-lesson, should they come upon a problem they cannot solve. A programming error may prove difficult to troubleshoot or some other hurdle could be getting in the way.
If needed, “our team members can jump on a Zoom call and guide the students through the rest of the lesson, and help the teacher see what that looks like and what that feels like and kind of watch that process,” Salvail said.
CURRICULUM PHILOSOPHY
Cyber.org encourages including hands-on teaching. It offers a virtual cyber range so high school students can learn about attacks by trying out conducting and defending against them. Rather than just telling kids to be wary of phishing, schools can make the point real by letting students — in a controlled environment — create their own phishing emails, then open the malicious links on a designated computer and watch the damage, Salvail said.
That kind of hands-on engagement seems to be winning points with students, too. Southwood High senior Tyler Williams has been taking cyber classes for several years through Project REACH. He said a favorite part of the program is practicing counter-hacking, where defense teams compete to keep a system safe against an attacking team. If he were to recommend any changes to the program, he said it’d be to add more hands-on activities and competitions.
Wright, too, spoke of the hands-on engagement, saying he particularly liked practicing ethical hacking in the safe space of the labs, where such activities wouldn’t cause any real-world harm.
That speaks to another piece of the program: the ethics component. Salvail said lessons about computer skills also need to be paired with lessons on what not to do. That’s important to include even in programs for younger grades, where kids may not immediately realize the seriousness of digital transgressions.
“If we’re going to show these things to kids, and talk about these things, we do have to look at the whole ethical side of things. They can't be employed by the government if they have charges against them. So if you choose to try to hack into the local company down the street, and you get caught doing so — which is very easy to get caught — you've destroyed your cybersecurity career,” Salvail said. “... We’ve got elementary school kids who have records and who are no longer going to be able to be employed in cybersecurity, because they did some things by following some YouTube videos that they should not have done and that are felonies.”
QUANTIFYING IMPACT?
Cyber.org currently surveys teachers for feedback and asks them to poll students about topics like whether they’re now considering going into cyber.
But soon the organization will look to get more concrete data.
Next school year, the program will bring in an outside party to begin conducting more detailed research. That’ll likely include an at least five-year longitudinal study to assess the impact on students who begin the program in grade 9, tracing whether they continue on in higher education.
The study will look to assess elements like how high schools offering a full cyber class versus a cyber club correlates with students interest in cyber careers, and how many students try for certifications and which ones they obtain.
